@treeseed/sdk 0.11.0 → 0.12.5

package/dist/workflow-state.js

@@ -11,6 +11,7 @@ import {
   collectTreeseedEnvironmentContext,
   withTreeseedKeyAgentAutopromptDisabled
 } from "./operations/services/config-runtime.js";
+import { resolveTreeseedGitHubToken } from "./service-credentials.js";
 import { resolveWranglerBin } from "./operations/services/runtime-tools.js";
 import { getTreeseedEnvironmentSuggestedValues, validateTreeseedEnvironmentValues } from "./platform/environment.js";
 import { resolveTreeseedWebCachePolicy } from "./platform/deploy-config.js";
@@ -19,10 +20,11 @@ import {
   createPersistentDeployTarget,
   loadDeployState
 } from "./operations/services/deploy.js";
-import { loadCliDeployConfig } from "./operations/services/runtime-tools.js";
+import { loadTreeseedPlatformConfig } from "./platform/config.js";
 import { collectCliPreflight } from "./operations/services/workspace-preflight.js";
 import { collectPublicPackageReleaseLineState, currentBranch, gitStatusPorcelain } from "./operations/services/workspace-save.js";
-import { hasCompleteTreeseedPackageCheckout, isWorkspaceRoot, run } from "./operations/services/workspace-tools.js";
+import { hasCompleteTreeseedPackageCheckout, isWorkspaceRoot } from "./operations/services/workspace-tools.js";
+import { classifyTreeseedGitMode, runTreeseedGitText } from "./operations/services/git-runner.js";
 import { packageAdapterPlanSummary } from "./operations/services/package-adapters.js";
 import { inspectWorkspaceDependencyMode } from "./operations/services/workspace-dependency-mode.js";
 import { inspectDetachedHeadRepair, PRODUCTION_BRANCH, STAGING_BRANCH } from "./operations/services/git-workflow.js";
@@ -32,6 +34,14 @@ import {
   resolveTreeseedWorkflowPaths,
   workflowEnvironmentForBranchRole
 } from "./workflow/policy.js";
+function runGit(args, options) {
+  return runTreeseedGitText(args, {
+    cwd: options.cwd,
+    mode: classifyTreeseedGitMode(args),
+    timeoutMs: options.timeoutMs,
+    maxBuffer: options.maxBuffer
+  });
+}
 function emptyPersistentEnvironments() {
   return {
     local: { initialized: false, phase: "pending", configured: false, provisioned: false, deployable: false, blockers: [], warnings: [], lastValidatedAt: null, lastDeploymentTimestamp: null, lastDeployedUrl: null },
@@ -142,7 +152,7 @@ function providerProblems(validation, provider) {
     const id = problem.id.toUpperCase();
     const group = problem.entry.group;
     if (provider === "github") {
-      return id === "GH_TOKEN" || id === "GITHUB_TOKEN" || group === "github";
+      return id === "TREESEED_GITHUB_TOKEN" || group === "github";
     }
     if (provider === "cloudflare") {
       return id.startsWith("CLOUDFLARE_") || id.includes("TURNSTILE") || group === "cloudflare";
@@ -208,9 +218,9 @@ function providerLiveCheck(provider, configured, cwd, env) {
 }
 function providerStatusForScope(cwd, scope, statusConfig, options) {
   const values = statusConfig.values;
-  const githubConfigured = typeof values.GH_TOKEN === "string" && values.GH_TOKEN.trim().length > 0;
-  const cloudflareConfigured = typeof values.CLOUDFLARE_API_TOKEN === "string" && values.CLOUDFLARE_API_TOKEN.trim().length > 0;
-  const railwayConfigured = typeof values.RAILWAY_API_TOKEN === "string" && values.RAILWAY_API_TOKEN.trim().length > 0;
+  const githubConfigured = Boolean(resolveTreeseedGitHubToken(values));
+  const cloudflareConfigured = typeof values.TREESEED_CLOUDFLARE_API_TOKEN === "string" && values.TREESEED_CLOUDFLARE_API_TOKEN.trim().length > 0;
+  const railwayConfigured = typeof values.TREESEED_RAILWAY_API_TOKEN === "string" && values.TREESEED_RAILWAY_API_TOKEN.trim().length > 0;
   const localDevelopmentConfigured = providerProblems(statusConfig.validation, "localDevelopment").length === 0;
   const live = options.live === true;
   const env = statusConfig.resolvedValues;
@@ -244,7 +254,7 @@ function hasStatusConfigValue(statusConfigByScope, key) {
 }
 function knownRemoteTrackingBranchExists(repoDir, branchName) {
   try {
-    run("git", ["show-ref", "--verify", "--quiet", `refs/remotes/origin/${branchName}`], { cwd: repoDir, capture: true });
+    runGit(["show-ref", "--verify", "--quiet", `refs/remotes/origin/${branchName}`], { cwd: repoDir, capture: true });
     return true;
   } catch {
     return false;
@@ -252,7 +262,7 @@ function knownRemoteTrackingBranchExists(repoDir, branchName) {
 }
 function safeHeadCommit(repoDir) {
   try {
-    return run("git", ["rev-parse", "HEAD"], { cwd: repoDir, capture: true }).trim();
+    return runGit(["rev-parse", "HEAD"], { cwd: repoDir, capture: true }).trim();
   } catch {
     return null;
   }
@@ -268,14 +278,14 @@ function safeReleaseHistory(repoDir) {
     };
   }
   try {
-    const output = run("git", ["rev-list", "--left-right", "--count", "staging...main"], { cwd: repoDir, capture: true }).trim();
+    const output = runGit(["rev-list", "--left-right", "--count", "staging...main"], { cwd: repoDir, capture: true }).trim();
     const [aheadRaw, behindRaw] = output.split(/\s+/u);
     const stagingAheadMain = Number.parseInt(aheadRaw ?? "", 10);
     const stagingBehindMain = Number.parseInt(behindRaw ?? "", 10);
     if (!Number.isFinite(stagingAheadMain) || !Number.isFinite(stagingBehindMain)) {
       throw new Error("invalid rev-list output");
     }
-    const stagingOnlySubjects = run("git", ["log", "--format=%s", "main..staging"], { cwd: repoDir, capture: true }).split("\n").map((line) => line.trim()).filter(Boolean);
+    const stagingOnlySubjects = runGit(["log", "--format=%s", "main..staging"], { cwd: repoDir, capture: true }).split("\n").map((line) => line.trim()).filter(Boolean);
     const unreleasedStagingCommits = stagingOnlySubjects.filter((subject) => subject !== "release: sync package staging heads" && subject !== "release: back-merge main into staging" && !subject.startsWith("release: back-merge main into staging ")).length;
     return {
       stagingAheadMain,
@@ -352,7 +362,7 @@ function resolveTreeseedWorkflowState(cwd, options = {}) {
         localBranch = true;
       } else {
         try {
-          run("git", ["show-ref", "--verify", "--quiet", `refs/heads/${expectedBranch}`], { cwd: packageDir, capture: true });
+          runGit(["show-ref", "--verify", "--quiet", `refs/heads/${expectedBranch}`], { cwd: packageDir, capture: true });
           localBranch = true;
         } catch {
           localBranch = false;
@@ -415,7 +425,7 @@ function resolveTreeseedWorkflowState(cwd, options = {}) {
   const marketSettings = machineConfig?.settings?.market && typeof machineConfig.settings.market === "object" ? machineConfig.settings.market : null;
   const runnerHostId = typeof marketSettings?.runnerHostId === "string" && marketSettings.runnerHostId.trim() ? marketSettings.runnerHostId.trim() : typeof marketSettings?.projectId === "string" && marketSettings.projectId.trim() ? `operations-runner:${marketSettings.projectId.trim()}` : null;
   const runnerSession = runnerHostId ? safeResolveRemoteSession(effectiveCwd, runnerHostId) : null;
-  const workflowLock = inspectWorkflowLock(effectiveCwd);
+  const workflowLock = inspectWorkflowLock(effectiveCwd, { scope: "worktree" });
   const workflowRunHeads = {};
   if (root) {
     workflowRunHeads["@treeseed/market"] = safeHeadCommit(root);
@@ -490,7 +500,7 @@ function resolveTreeseedWorkflowState(cwd, options = {}) {
       blockers: workflowBlockers
     },
     packageSync: {
-      mode: completePackageCheckout ? "recursive-workspace" : "root-only",
+      mode: completePackageCheckout || packageSyncRepos.length > 0 ? "recursive-workspace" : "root-only",
       completeCheckout: completePackageCheckout,
       dependencyMode: workspaceDependencyMode.mode,
       workspaceLinks: workspaceDependencyMode,
@@ -590,7 +600,7 @@ function resolveTreeseedWorkflowState(cwd, options = {}) {
   };
   if (tenantRoot) {
     try {
-      const deployConfig = loadCliDeployConfig(effectiveCwd);
+      const deployConfig = loadTreeseedPlatformConfig({ tenantRoot: effectiveCwd, environment: workflowEnvironmentForBranchRole(branchRole), env: options.env ?? process.env }).deployConfig;
       const environmentContext = collectTreeseedEnvironmentContext(effectiveCwd);
       const statusConfigByScope = Object.fromEntries(
         ["local", "staging", "prod"].map((scope) => [
@@ -613,9 +623,9 @@ function resolveTreeseedWorkflowState(cwd, options = {}) {
       const runtimeSessionReady = Boolean(
         marketSettings?.runnerReady === true || typeof runnerSession?.accessToken === "string" && runnerSession.accessToken.length > 0
       );
-      state.auth.gh = state.auth.gh || hasStatusConfigValue(statusConfigByScope, "GH_TOKEN");
-      state.auth.wrangler = state.auth.wrangler || hasStatusConfigValue(statusConfigByScope, "CLOUDFLARE_API_TOKEN");
-      state.auth.railway = state.auth.railway || hasStatusConfigValue(statusConfigByScope, "RAILWAY_API_TOKEN");
+      state.auth.gh = state.auth.gh || Boolean(resolveTreeseedGitHubToken(statusConfigByScope.local.values)) || Boolean(resolveTreeseedGitHubToken(statusConfigByScope.staging.values)) || Boolean(resolveTreeseedGitHubToken(statusConfigByScope.prod.values));
+      state.auth.wrangler = state.auth.wrangler || hasStatusConfigValue(statusConfigByScope, "TREESEED_CLOUDFLARE_API_TOKEN");
+      state.auth.railway = state.auth.railway || hasStatusConfigValue(statusConfigByScope, "TREESEED_RAILWAY_API_TOKEN");
       state.auth.copilot = state.auth.copilot || state.auth.gh;
       state.marketConnection.baseUrl = state.marketConnection.baseUrl ?? sharedConfigValues.TREESEED_API_BASE_URL ?? deployConfig.runtime?.marketBaseUrl ?? deployConfig.hosting?.marketBaseUrl ?? null;
       state.marketConnection.teamId = state.marketConnection.teamId ?? sharedConfigValues.TREESEED_HOSTING_TEAM_ID ?? deployConfig.runtime?.teamId ?? deployConfig.hosting?.teamId ?? null;

package/dist/workflow-support.d.ts

@@ -1,25 +1,26 @@
-export { applyTreeseedConfigValues, applyTreeseedEnvironmentToProcess, applyTreeseedSafeRepairs, assertTreeseedCommandEnvironment, checkTreeseedProviderConnections, clearTreeseedRemoteSession, collectTreeseedConfigContext, collectTreeseedConfigSeedValues, collectTreeseedPrintEnvReport, createDefaultTreeseedMachineConfig, ensureTreeseedActVerificationTooling, ensureTreeseedSecretSessionForConfig, ensureTreeseedGitignoreEntries, getTreeseedMachineConfigPaths, loadTreeseedMachineConfig, listRelevantTreeseedConfigEntries, finalizeTreeseedConfig, inspectTreeseedKeyAgentTransportDiagnostic, inspectTreeseedPassphraseEnvDiagnostic, listDeprecatedTreeseedLocalEnvFiles, inspectTreeseedKeyAgentStatus, lockTreeseedSecretSession, migrateTreeseedMachineKeyToWrapped, resolveTreeseedMachineEnvironmentValues, resolveTreeseedLaunchEnvironment, resolveTreeseedRemoteConfig, resolveTreeseedRemoteSession, rotateTreeseedMachineKey, rotateTreeseedMachineKeyPassphrase, setTreeseedRemoteSession, TREESEED_MACHINE_KEY_PASSPHRASE_ENV, TreeseedKeyAgentError, updateTreeseedDeployConfigFeatureToggles, unlockTreeseedSecretSessionFromEnv, unlockTreeseedSecretSessionInteractive, unlockTreeseedSecretSessionWithPassphrase, withTreeseedKeyAgentAutopromptDisabled, warnDeprecatedTreeseedLocalEnvFiles, writeTreeseedMachineConfig, } from './operations/services/config-runtime.ts';
-export { exportTreeseedCodebase } from './operations/services/export-runtime.ts';
-export { formatTreeseedHostingAuditReport, resolveTreeseedHostingAuditTarget, runTreeseedHostingAudit, type TreeseedHostingAuditCheck, type TreeseedHostingAuditEnvironment, type TreeseedHostingAuditHostKind, type TreeseedHostingAuditReport, } from './operations/services/hosting-audit.ts';
-export { collectTreeseedHostedServiceChecks, type TreeseedHostedServiceCheck, type TreeseedHostedServiceCheckReport, type TreeseedHostedServiceCheckStatus, type TreeseedHostedServiceType, type TreeseedObservedRailwayServiceState, } from './operations/services/hosted-service-checks.ts';
-export { collectTreeseedDeploymentReadiness, formatTreeseedReadinessReport, type TreeseedDeploymentReadinessCheck, type TreeseedDeploymentReadinessReport, type TreeseedDeploymentReadinessStatus, } from './operations/services/deployment-readiness.ts';
-export { collectTreeseedLiveHostedServiceChecks, type TreeseedLiveHostedServiceCheckOptions, type TreeseedLiveHostedServiceCheckReport, } from './operations/services/live-hosted-service-checks.ts';
-export { runTreeseedOperationsRunnerSmoke, type TreeseedOperationsRunnerSmokeOptions, type TreeseedOperationsRunnerSmokeReport, } from './operations/services/operations-runner-smoke.ts';
-export { readTreeseedVerificationCache, treeseedVerificationCacheKey, writeTreeseedVerificationCache, type TreeseedVerificationCacheEntry, } from './operations/services/verification-cache.ts';
-export { assertDeploymentInitialized, cleanupDestroyedState, createBranchPreviewDeployTarget, createPersistentDeployTarget, deployTargetLabel, destroyCloudflareResources, ensureGeneratedWranglerConfig, finalizeDeploymentState, loadDeployState, printDeploySummary, printDestroySummary, provisionCloudflareResources, runRemoteD1Migrations, syncCloudflareSecrets, validateDeployPrerequisites, validateDestroyPrerequisites, } from './operations/services/deploy.ts';
-export { assertCleanWorktree, assertFeatureBranch, branchExists, checkoutBranch, createDeprecatedTaskTag, createFeatureBranchFromStaging, currentManagedBranch, deleteLocalBranch, deleteRemoteBranch, ensureLocalBranchTracking, gitWorkflowRoot, listTaskBranches, mergeCurrentBranchIntoStaging, mergeStagingIntoMain, prepareReleaseBranches, PRODUCTION_BRANCH, pushBranch, remoteBranchExists, STAGING_BRANCH, syncBranchWithOrigin, waitForStagingAutomation, } from './operations/services/git-workflow.ts';
-export { dockerIsAvailable, stopKnownMailpitContainers, type TreeseedMailpitContainer, } from './operations/services/mailpit-runtime.ts';
-export { loadCliDeployConfig, packageScriptPath, resolveWranglerBin, } from './operations/services/runtime-tools.ts';
-export { configuredRailwayServices, deployRailwayService, validateRailwayDeployPrerequisites, } from './operations/services/railway-deploy.ts';
-export { deleteRailwayProject, ensureRailwayEnvironment, ensureRailwayProject, ensureRailwayService, getRailwayAuthProfile, listRailwayEnvironments, listRailwayProjects, listRailwayServices, listRailwayVariables, railwayGraphqlRequest, resolveRailwayApiToken, resolveRailwayApiUrl, resolveRailwayWorkspace, resolveRailwayWorkspaceContext, upsertRailwayVariables, } from './operations/services/railway-api.ts';
-export { githubRepositoryCredentialEnvName, resolveGitHubCredentialForRepository, type TreeseedGitHubCredentialResolution, } from './operations/services/github-credentials.ts';
-export { createGitHubApiClient, dispatchGitHubWorkflowRun, ensureGitHubActionsEnvironment, getLatestGitHubWorkflowRun, listGitHubEnvironmentSecretNames, listGitHubEnvironmentVariableNames, type GitHubWorkflowDispatchResult, type GitHubWorkflowRunSummary, upsertGitHubEnvironmentSecret, upsertGitHubEnvironmentVariable, } from './operations/services/github-api.ts';
-export { discoverTreeseedPackageAdapters, findTreeseedPackageAdapter, packageAdapterPlanSummary, planTreeseedPackageDevelopmentImage, type TreeseedPackageAdapter, type TreeseedPackageDevelopmentImagePlan, } from './operations/services/package-adapters.ts';
-export { runTenantDeployPreflight, runWorkspaceReleasePreflight, runWorkspaceSavePreflight, } from './operations/services/save-deploy-preflight.ts';
-export { collectCliPreflight } from './operations/services/workspace-preflight.ts';
-export { collectTreeseedDependencyStatus, collectTreeseedToolStatus, createTreeseedManagedToolEnv, formatTreeseedDependencyFailureDetails, formatTreeseedDependencyReport, installTreeseedDependencies, resolveTreeseedToolBinary, resolveTreeseedToolCommand, type TreeseedToolStatusResult, } from './managed-dependencies.ts';
-export { runTreeseedCopilotTask, type TreeseedCopilotTaskInput, type TreeseedCopilotTaskResult, } from './copilot.ts';
-export { applyWorkspaceVersionChanges, collectMergeConflictReport, currentBranch, formatMergeConflictReport, gitStatusPorcelain, hasMeaningfulChanges, incrementVersion, originRemoteUrl, planWorkspaceReleaseBump, repoRoot, } from './operations/services/workspace-save.ts';
-export { assertNoWorkspaceLinksInDeploymentLockfiles, collectDeploymentLockfileWorkspaceIssues, discoverWorkspaceLinks, ensureLocalWorkspaceLinks, inspectWorkspaceDependencyMode, unlinkLocalWorkspaceLinks, type DependencyResolutionMode, type DeploymentLockfileWorkspaceIssue, type WorkspaceLinksMode, } from './operations/services/workspace-dependency-mode.ts';
-export { findNearestTreeseedRoot, findNearestTreeseedWorkspaceRoot, isWorkspaceRoot, run, workspaceRoot, } from './operations/services/workspace-tools.ts';
-export { collectTreeseedReconcileStatus, createTreeseedReconcileRegistry, deriveTreeseedDesiredUnits, destroyTreeseedTargetUnits, planTreeseedReconciliation, refreshTreeseedUnits, reconcileTreeseedTarget, } from './reconcile/index.ts';
+export { applyTreeseedConfigValues, applyTreeseedEnvironmentToProcess, applyTreeseedSafeRepairs, assertTreeseedCommandEnvironment, checkTreeseedProviderConnections, clearTreeseedRemoteSession, collectTreeseedConfigContext, collectTreeseedConfigSeedValues, collectTreeseedPrintEnvReport, createDefaultTreeseedMachineConfig, ensureTreeseedActVerificationTooling, ensureTreeseedSecretSessionForConfig, ensureTreeseedGitignoreEntries, getTreeseedMachineConfigPaths, loadTreeseedMachineConfig, listRelevantTreeseedConfigEntries, finalizeTreeseedConfig, inspectTreeseedKeyAgentTransportDiagnostic, inspectTreeseedPassphraseEnvDiagnostic, listDeprecatedTreeseedLocalEnvFiles, inspectTreeseedKeyAgentStatus, lockTreeseedSecretSession, migrateTreeseedMachineKeyToWrapped, resolveTreeseedMachineEnvironmentValues, resolveTreeseedLaunchEnvironment, resolveTreeseedRemoteConfig, resolveTreeseedRemoteSession, rotateTreeseedMachineKey, rotateTreeseedMachineKeyPassphrase, setTreeseedRemoteSession, TREESEED_MACHINE_KEY_PASSPHRASE_ENV, TreeseedKeyAgentError, updateTreeseedDeployConfigFeatureToggles, unlockTreeseedSecretSessionFromEnv, unlockTreeseedSecretSessionInteractive, unlockTreeseedSecretSessionWithPassphrase, withTreeseedKeyAgentAutopromptDisabled, warnDeprecatedTreeseedLocalEnvFiles, writeTreeseedMachineConfig, } from './operations/services/config-runtime.js';
+export { exportTreeseedCodebase } from './operations/services/export-runtime.js';
+export { formatTreeseedHostingAuditReport, resolveTreeseedHostingAuditTarget, runTreeseedHostingAudit, type TreeseedHostingAuditCheck, type TreeseedHostingAuditEnvironment, type TreeseedHostingAuditHostKind, type TreeseedHostingAuditReport, } from './operations/services/hosting-audit.js';
+export { collectTreeseedHostedServiceChecks, type TreeseedHostedServiceCheck, type TreeseedHostedServiceCheckReport, type TreeseedHostedServiceCheckStatus, type TreeseedHostedServiceType, type TreeseedObservedRailwayServiceState, } from './operations/services/hosted-service-checks.js';
+export { collectTreeseedDeploymentReadiness, formatTreeseedReadinessReport, type TreeseedDeploymentReadinessCheck, type TreeseedDeploymentReadinessReport, type TreeseedDeploymentReadinessStatus, } from './operations/services/deployment-readiness.js';
+export { collectTreeseedLiveHostedServiceChecks, type TreeseedLiveHostedServiceCheckOptions, type TreeseedLiveHostedServiceCheckReport, } from './operations/services/live-hosted-service-checks.js';
+export { runTreeseedOperationsRunnerSmoke, type TreeseedOperationsRunnerSmokeOptions, type TreeseedOperationsRunnerSmokeReport, } from './operations/services/operations-runner-smoke.js';
+export { readTreeseedVerificationCache, treeseedVerificationCacheKey, writeTreeseedVerificationCache, type TreeseedVerificationCacheEntry, } from './operations/services/verification-cache.js';
+export { assertDeploymentInitialized, cleanupDestroyedState, createBranchPreviewDeployTarget, createPersistentDeployTarget, deployTargetLabel, destroyCloudflareResources, ensureGeneratedWranglerConfig, finalizeDeploymentState, loadDeployState, printDeploySummary, printDestroySummary, provisionCloudflareResources, runRemoteD1Migrations, syncCloudflareSecrets, validateDeployPrerequisites, validateDestroyPrerequisites, } from './operations/services/deploy.js';
+export { assertCleanWorktree, assertFeatureBranch, branchExists, checkoutBranch, createFeatureBranchFromStaging, currentManagedBranch, deleteLocalBranch, deleteRemoteBranch, ensureLocalBranchTracking, gitWorkflowRoot, listTaskBranches, mergeCurrentBranchIntoStaging, mergeStagingIntoMain, prepareReleaseBranches, PRODUCTION_BRANCH, pushBranch, remoteBranchExists, STAGING_BRANCH, syncBranchWithOrigin, waitForStagingAutomation, } from './operations/services/git-workflow.js';
+export { loadCliDeployConfig, packageScriptPath, resolveWranglerBin, } from './operations/services/runtime-tools.js';
+export { configuredRailwayServices, validateRailwayDeployPrerequisites, } from './operations/services/railway-deploy.js';
+export { getRailwayAuthProfile, listRailwayEnvironments, listRailwayProjects, listRailwayServices, listRailwayVariables, resolveRailwayApiToken, resolveRailwayApiUrl, resolveRailwayWorkspace, resolveRailwayWorkspaceContext, } from './operations/services/railway-api.js';
+export { githubRepositoryCredentialEnvName, resolveGitHubCredentialForRepository, type TreeseedGitHubCredentialResolution, } from './operations/services/github-credentials.js';
+export { createGitHubApiClient, ensureGitHubActionsEnvironment, getLatestGitHubWorkflowRun, listGitHubEnvironmentSecretNames, listGitHubEnvironmentVariableNames, type GitHubWorkflowDispatchResult, type GitHubWorkflowRunSummary, } from './operations/services/github-api.js';
+export { inspectTreeseedGitLocks, inspectTreeseedGitLockSet, inspectTreeseedWorkspaceGitLocks, recoverTreeseedGitLocks, runTreeseedGitBatch, runTreeseedGit, type TreeseedGitLockDiagnostic, type TreeseedGitLockKind, type TreeseedGitLockProcessHint, type TreeseedGitBatchOperation, type TreeseedGitRunnerMode, type TreeseedGitRunnerResult, type TreeseedGitWorkspaceLockDiagnostics, } from './operations/services/git-runner.js';
+export { discoverTreeseedPackageAdapters, findTreeseedPackageAdapter, packageAdapterPlanSummary, planTreeseedPackageDevelopmentImage, runTreeseedPackageImageWorkflow, syncTreeseedPackageWorkflows, validateTreeseedPackageManifests, type TreeseedPackageAdapter, type TreeseedPackageDevelopmentImagePlan, type TreeseedPackageImageWorkflowOptions, type TreeseedPackageManifestValidation, type TreeseedPackageWorkflowSyncResult, type TreeseedPackageWorkflowTemplateKind, } from './operations/services/package-adapters.js';
+export { runTenantDeployPreflight, runWorkspaceReleasePreflight, runWorkspaceSavePreflight, } from './operations/services/save-deploy-preflight.js';
+export { collectCliPreflight } from './operations/services/workspace-preflight.js';
+export { collectTreeseedDependencyStatus, collectTreeseedToolStatus, createTreeseedManagedToolEnv, formatTreeseedDependencyFailureDetails, formatTreeseedDependencyReport, installTreeseedDependencies, resolveTreeseedToolBinary, resolveTreeseedToolCommand, type TreeseedToolStatusResult, } from './managed-dependencies.js';
+export { runTreeseedCopilotTask, type TreeseedCopilotTaskInput, type TreeseedCopilotTaskResult, } from './copilot.js';
+export { applyWorkspaceVersionChanges, collectMergeConflictReport, currentBranch, formatMergeConflictReport, gitStatusPorcelain, hasMeaningfulChanges, incrementVersion, originRemoteUrl, planWorkspaceReleaseBump, repoRoot, } from './operations/services/workspace-save.js';
+export { assertNoWorkspaceLinksInDeploymentLockfiles, collectDeploymentLockfileWorkspaceIssues, discoverWorkspaceLinks, ensureLocalWorkspaceLinks, inspectWorkspaceDependencyMode, unlinkLocalWorkspaceLinks, type DependencyResolutionMode, type DeploymentLockfileWorkspaceIssue, type WorkspaceLinksMode, } from './operations/services/workspace-dependency-mode.js';
+export { findNearestTreeseedRoot, findNearestTreeseedWorkspaceRoot, isWorkspaceRoot, run, workspaceRoot, } from './operations/services/workspace-tools.js';
+export { resolveTreeseedWorkflowPaths, } from './workflow/policy.js';
+export { collectTreeseedReconcileStatus, createTreeseedReconcileRegistry, deriveTreeseedDesiredUnits, destroyTreeseedTargetUnits, planTreeseedReconciliation, refreshTreeseedUnits, reconcileTreeseedTarget, } from './reconcile/index.js';

package/dist/workflow-support.js

@@ -86,7 +86,6 @@ import {
   assertFeatureBranch,
   branchExists,
   checkoutBranch,
-  createDeprecatedTaskTag,
   createFeatureBranchFromStaging,
   currentManagedBranch,
   deleteLocalBranch,
@@ -104,10 +103,6 @@ import {
   syncBranchWithOrigin,
   waitForStagingAutomation
 } from "./operations/services/git-workflow.js";
-import {
-  dockerIsAvailable,
-  stopKnownMailpitContainers
-} from "./operations/services/mailpit-runtime.js";
 import {
   loadCliDeployConfig,
   packageScriptPath,
@@ -115,25 +110,18 @@ import {
 } from "./operations/services/runtime-tools.js";
 import {
   configuredRailwayServices,
-  deployRailwayService,
   validateRailwayDeployPrerequisites
 } from "./operations/services/railway-deploy.js";
 import {
-  deleteRailwayProject,
-  ensureRailwayEnvironment,
-  ensureRailwayProject,
-  ensureRailwayService,
   getRailwayAuthProfile,
   listRailwayEnvironments,
   listRailwayProjects,
   listRailwayServices,
   listRailwayVariables,
-  railwayGraphqlRequest,
   resolveRailwayApiToken,
   resolveRailwayApiUrl,
   resolveRailwayWorkspace,
-  resolveRailwayWorkspaceContext,
-  upsertRailwayVariables
+  resolveRailwayWorkspaceContext
 } from "./operations/services/railway-api.js";
 import {
   githubRepositoryCredentialEnvName,
@@ -141,19 +129,27 @@ import {
 } from "./operations/services/github-credentials.js";
 import {
   createGitHubApiClient,
-  dispatchGitHubWorkflowRun,
   ensureGitHubActionsEnvironment,
   getLatestGitHubWorkflowRun,
   listGitHubEnvironmentSecretNames,
-  listGitHubEnvironmentVariableNames,
-  upsertGitHubEnvironmentSecret,
-  upsertGitHubEnvironmentVariable
+  listGitHubEnvironmentVariableNames
 } from "./operations/services/github-api.js";
+import {
+  inspectTreeseedGitLocks,
+  inspectTreeseedGitLockSet,
+  inspectTreeseedWorkspaceGitLocks,
+  recoverTreeseedGitLocks,
+  runTreeseedGitBatch,
+  runTreeseedGit
+} from "./operations/services/git-runner.js";
 import {
   discoverTreeseedPackageAdapters,
   findTreeseedPackageAdapter,
   packageAdapterPlanSummary,
-  planTreeseedPackageDevelopmentImage
+  planTreeseedPackageDevelopmentImage,
+  runTreeseedPackageImageWorkflow,
+  syncTreeseedPackageWorkflows,
+  validateTreeseedPackageManifests
 } from "./operations/services/package-adapters.js";
 import {
   runTenantDeployPreflight,
@@ -201,6 +197,9 @@ import {
   run,
   workspaceRoot
 } from "./operations/services/workspace-tools.js";
+import {
+  resolveTreeseedWorkflowPaths
+} from "./workflow/policy.js";
 import {
   collectTreeseedReconcileStatus,
   createTreeseedReconcileRegistry,
@@ -244,7 +243,6 @@ export {
   configuredRailwayServices,
   createBranchPreviewDeployTarget,
   createDefaultTreeseedMachineConfig,
-  createDeprecatedTaskTag,
   createFeatureBranchFromStaging,
   createGitHubApiClient,
   createPersistentDeployTarget,
@@ -253,24 +251,17 @@ export {
   currentBranch,
   currentManagedBranch,
   deleteLocalBranch,
-  deleteRailwayProject,
   deleteRemoteBranch,
-  deployRailwayService,
   deployTargetLabel,
   deriveTreeseedDesiredUnits,
   destroyCloudflareResources,
   destroyTreeseedTargetUnits,
   discoverTreeseedPackageAdapters,
   discoverWorkspaceLinks,
-  dispatchGitHubWorkflowRun,
-  dockerIsAvailable,
   ensureGeneratedWranglerConfig,
   ensureGitHubActionsEnvironment,
   ensureLocalBranchTracking,
   ensureLocalWorkspaceLinks,
-  ensureRailwayEnvironment,
-  ensureRailwayProject,
-  ensureRailwayService,
   ensureTreeseedActVerificationTooling,
   ensureTreeseedGitignoreEntries,
   ensureTreeseedSecretSessionForConfig,
@@ -293,9 +284,12 @@ export {
   githubRepositoryCredentialEnvName,
   hasMeaningfulChanges,
   incrementVersion,
+  inspectTreeseedGitLockSet,
+  inspectTreeseedGitLocks,
   inspectTreeseedKeyAgentStatus,
   inspectTreeseedKeyAgentTransportDiagnostic,
   inspectTreeseedPassphraseEnvDiagnostic,
+  inspectTreeseedWorkspaceGitLocks,
   inspectWorkspaceDependencyMode,
   installTreeseedDependencies,
   isWorkspaceRoot,
@@ -326,9 +320,9 @@ export {
   printDestroySummary,
   provisionCloudflareResources,
   pushBranch,
-  railwayGraphqlRequest,
   readTreeseedVerificationCache,
   reconcileTreeseedTarget,
+  recoverTreeseedGitLocks,
   refreshTreeseedUnits,
   remoteBranchExists,
   repoRoot,
@@ -344,6 +338,7 @@ export {
   resolveTreeseedRemoteSession,
   resolveTreeseedToolBinary,
   resolveTreeseedToolCommand,
+  resolveTreeseedWorkflowPaths,
   resolveWranglerBin,
   rotateTreeseedMachineKey,
   rotateTreeseedMachineKeyPassphrase,
@@ -351,26 +346,27 @@ export {
   runRemoteD1Migrations,
   runTenantDeployPreflight,
   runTreeseedCopilotTask,
+  runTreeseedGit,
+  runTreeseedGitBatch,
   runTreeseedHostingAudit,
   runTreeseedOperationsRunnerSmoke,
+  runTreeseedPackageImageWorkflow,
   runWorkspaceReleasePreflight,
   runWorkspaceSavePreflight,
   setTreeseedRemoteSession,
-  stopKnownMailpitContainers,
   syncBranchWithOrigin,
   syncCloudflareSecrets,
+  syncTreeseedPackageWorkflows,
   treeseedVerificationCacheKey,
   unlinkLocalWorkspaceLinks,
   unlockTreeseedSecretSessionFromEnv,
   unlockTreeseedSecretSessionInteractive,
   unlockTreeseedSecretSessionWithPassphrase,
   updateTreeseedDeployConfigFeatureToggles,
-  upsertGitHubEnvironmentSecret,
-  upsertGitHubEnvironmentVariable,
-  upsertRailwayVariables,
   validateDeployPrerequisites,
   validateDestroyPrerequisites,
   validateRailwayDeployPrerequisites,
+  validateTreeseedPackageManifests,
   waitForStagingAutomation,
   warnDeprecatedTreeseedLocalEnvFiles,
   withTreeseedKeyAgentAutopromptDisabled,

package/dist/workflow.d.ts

@@ -1,8 +1,8 @@
-import { resolveTreeseedWorkflowState, type TreeseedWorkflowStatusOptions } from './workflow-state.ts';
-import { listTaskBranches } from './operations/services/git-workflow.ts';
-import type { GitHubActionsVerificationReport } from './operations/services/github-actions-verification.ts';
-import { TreeseedWorkflowError, type TreeseedWorkflowErrorCode } from './workflow/operations.ts';
-export type TreeseedWorkflowOperationId = 'status' | 'ci' | 'config' | 'tasks' | 'switch' | 'dev' | 'save' | 'close' | 'stage' | 'release' | 'tags:cleanup' | 'resume' | 'recover' | 'destroy' | 'export';
+import { resolveTreeseedWorkflowState, type TreeseedWorkflowStatusOptions } from './workflow-state.js';
+import { listTaskBranches } from './operations/services/git-workflow.js';
+import type { GitHubActionsVerificationReport } from './operations/services/github-actions-verification.js';
+import { TreeseedWorkflowError, type TreeseedWorkflowErrorCode } from './workflow/operations.js';
+export type TreeseedWorkflowOperationId = 'status' | 'ci' | 'config' | 'tasks' | 'switch' | 'dev' | 'save' | 'update' | 'close' | 'stage' | 'release-candidate' | 'proof' | 'release' | 'resume' | 'recover' | 'destroy' | 'export';
 export type TreeseedWorkflowNextStep = {
     operation: string;
     reason?: string;
@@ -32,6 +32,10 @@ export type TreeseedWorkflowWorktreeMode = 'auto' | 'on' | 'off';
 export type TreeseedWorkflowCiMode = 'auto' | 'hosted' | 'off';
 export type TreeseedWorkflowVerifyMode = 'fast' | 'local' | 'hosted' | 'both' | 'skip';
 export type TreeseedReleaseCandidateMode = 'hybrid' | 'strict' | 'skip';
+export type TreeseedReleaseCandidateVerifyDriver = 'auto' | 'local' | 'action';
+export type TreeseedStageVerifyMode = 'action' | 'local' | 'none';
+export type TreeseedStageCiMode = 'off' | 'hosted';
+export type TreeseedStageCleanupMode = 'success' | 'manual';
 export type TreeseedWorkflowContext = {
     cwd?: string;
     env?: NodeJS.ProcessEnv;
@@ -104,7 +108,7 @@ export type TreeseedSaveInput = {
     rebase?: boolean;
     bump?: 'major' | 'minor' | 'patch';
     devVersionStrategy?: 'prerelease';
-    devDependencyReferenceMode?: 'git-tag' | 'registry-prerelease';
+    devDependencyReferenceMode?: 'git-commit';
     gitDependencyProtocol?: 'preserve-origin' | 'https' | 'ssh';
     gitRemoteWriteMode?: 'ssh-pushurl' | 'off';
     verifyMode?: 'action-first' | 'local-only' | 'skip' | TreeseedWorkflowVerifyMode;
@@ -118,6 +122,15 @@ export type TreeseedSaveInput = {
     plan?: boolean;
     dryRun?: boolean;
 };
+export type TreeseedUpdateInput = {
+    from?: string;
+    strategy?: 'merge' | 'ff-only';
+    push?: boolean;
+    worktreeMode?: TreeseedWorkflowWorktreeMode;
+    workspaceLinks?: 'auto' | 'off';
+    plan?: boolean;
+    dryRun?: boolean;
+};
 export type TreeseedCiInput = {
     failed?: boolean;
     logs?: boolean;
@@ -150,17 +163,39 @@ export type TreeseedCloseInput = {
 };
 export type TreeseedStageInput = {
     message: string;
+    updateFrom?: string;
+    verifyMode?: TreeseedStageVerifyMode;
+    cleanupMode?: TreeseedStageCleanupMode;
     waitForStaging?: boolean;
     deletePreview?: boolean;
     deleteBranch?: boolean;
     autoSave?: boolean;
-    ciMode?: TreeseedWorkflowCiMode;
+    ciMode?: TreeseedStageCiMode | TreeseedWorkflowCiMode;
+    releaseCandidate?: TreeseedReleaseCandidateMode;
     worktreeMode?: TreeseedWorkflowWorktreeMode;
     workspaceLinks?: 'auto' | 'off';
     verifyDeployedResources?: boolean;
     plan?: boolean;
     dryRun?: boolean;
 };
+export type TreeseedReleaseCandidateInput = {
+    mode?: TreeseedReleaseCandidateMode;
+    verifyDriver?: TreeseedReleaseCandidateVerifyDriver;
+    package?: string | string[];
+    keepWorkspace?: boolean;
+    plan?: boolean;
+    dryRun?: boolean;
+};
+export type TreeseedProofInput = {
+    action?: 'plan' | 'run' | 'status' | 'failures' | 'explain' | 'clean';
+    target?: 'local' | 'staging' | 'prod';
+    driver?: 'local' | 'act' | 'github-hosted' | 'railway-live' | 'cloudflare-live' | 'reconcile-live';
+    subject?: string | null;
+    last?: boolean;
+    olderThan?: string | null;
+    plan?: boolean;
+    dryRun?: boolean;
+};
 export type TreeseedSwitchInput = {
     branch?: string;
     branchName?: string;
@@ -216,7 +251,6 @@ export type TreeseedReleaseInput = {
     bump: 'major' | 'minor' | 'patch';
     repairVersionLine?: boolean;
     targetVersionLine?: string;
-    devTagCleanup?: 'safe-after-release' | 'off';
     gitDependencyProtocol?: 'preserve-origin' | 'https' | 'ssh';
     gitRemoteWriteMode?: 'ssh-pushurl' | 'off';
     ciMode?: TreeseedWorkflowCiMode;
@@ -227,12 +261,6 @@ export type TreeseedReleaseInput = {
     plan?: boolean;
     dryRun?: boolean;
 };
-export type TreeseedTagsCleanupInput = {
-    includePackages?: string | string[];
-    branchScope?: 'staging' | 'preview' | 'all';
-    plan?: boolean;
-    dryRun?: boolean;
-};
 export type TreeseedResumeInput = {
     runId: string;
 };
@@ -268,7 +296,7 @@ export declare class TreeseedWorkflowSdk {
     private readonly context;
     constructor(context?: TreeseedWorkflowContext);
     private helpers;
-    execute(operation: TreeseedWorkflowOperationId, input?: Record<string, unknown>): Promise<TreeseedWorkflowResult<import("./workflow-state.ts").TreeseedWorkflowState> | TreeseedWorkflowResult<TreeseedCiResult> | TreeseedWorkflowResult<{
+    execute(operation: TreeseedWorkflowOperationId, input?: Record<string, unknown>): Promise<TreeseedWorkflowResult<import("./workflow-state.js").TreeseedWorkflowState> | TreeseedWorkflowResult<TreeseedCiResult> | TreeseedWorkflowResult<{
         tasks: TreeseedTaskBranchMetadata[];
         workstreams: TreeseedWorkflowWorkstreamSummary[];
     }> | TreeseedWorkflowResult<Record<string, unknown>>>;
@@ -282,10 +310,12 @@ export declare class TreeseedWorkflowSdk {
     switchTask(input: TreeseedSwitchInput): Promise<TreeseedWorkflowResult>;
     dev(input?: TreeseedWorkflowDevInput): Promise<TreeseedWorkflowResult>;
     save(input: TreeseedSaveInput): Promise<TreeseedWorkflowResult>;
+    update(input?: TreeseedUpdateInput): Promise<TreeseedWorkflowResult>;
     close(input: TreeseedCloseInput): Promise<TreeseedWorkflowResult>;
     stage(input: TreeseedStageInput): Promise<TreeseedWorkflowResult>;
+    releaseCandidate(input?: TreeseedReleaseCandidateInput): Promise<TreeseedWorkflowResult>;
+    proof(input?: TreeseedProofInput): Promise<TreeseedWorkflowResult>;
     release(input: TreeseedReleaseInput): Promise<TreeseedWorkflowResult>;
-    tagsCleanup(input?: TreeseedTagsCleanupInput): Promise<TreeseedWorkflowResult>;
     resume(input: TreeseedResumeInput): Promise<TreeseedWorkflowResult>;
     recover(input?: TreeseedRecoverInput): Promise<TreeseedWorkflowResult>;
     destroy(input: TreeseedDestroyInput): Promise<TreeseedWorkflowResult>;

package/dist/workflow.js

@@ -8,14 +8,16 @@ import {
   workflowDev,
   workflowExport,
   workflowRecover,
+  workflowReleaseCandidate,
+  workflowProof,
   workflowRelease,
   workflowResume,
   workflowSave,
   workflowStage,
   workflowStatus,
   workflowSwitch,
-  workflowTagsCleanup,
-  workflowTasks
+  workflowTasks,
+  workflowUpdate
 } from "./workflow/operations.js";
 function defaultWrite(output, stream = "stdout") {
   if (!output) return;
@@ -56,14 +58,18 @@ class TreeseedWorkflowSdk {
         return this.dev(input);
       case "save":
         return this.save(input);
+      case "update":
+        return this.update(input);
       case "close":
         return this.close(input);
       case "stage":
         return this.stage(input);
+      case "release-candidate":
+        return this.releaseCandidate(input);
+      case "proof":
+        return this.proof(input);
       case "release":
         return this.release(input);
-      case "tags:cleanup":
-        return this.tagsCleanup(input);
       case "resume":
         return this.resume(input);
       case "recover":
@@ -97,18 +103,24 @@ class TreeseedWorkflowSdk {
   async save(input) {
     return workflowSave(this.helpers(), input);
   }
+  async update(input = {}) {
+    return workflowUpdate(this.helpers(), input);
+  }
   async close(input) {
     return workflowClose(this.helpers(), input);
   }
   async stage(input) {
     return workflowStage(this.helpers(), input);
   }
+  async releaseCandidate(input = {}) {
+    return workflowReleaseCandidate(this.helpers(), input);
+  }
+  async proof(input = {}) {
+    return workflowProof(this.helpers(), input);
+  }
   async release(input) {
     return workflowRelease(this.helpers(), input);
   }
-  async tagsCleanup(input = {}) {
-    return workflowTagsCleanup(this.helpers(), input);
-  }
   async resume(input) {
     return workflowResume(this.helpers(), input);
   }

package/drizzle/d1/0000_treeseed_d1.sql

@@ -13,24 +13,6 @@ CREATE TABLE IF NOT EXISTS `contact_submissions` (
 
 CREATE INDEX IF NOT EXISTS `idx_contact_submissions_created_at` ON `contact_submissions` (`created_at`);
 CREATE INDEX IF NOT EXISTS `idx_contact_submissions_email` ON `contact_submissions` (`email`);
-CREATE TABLE IF NOT EXISTS `runtime_records` (
-	`id` integer PRIMARY KEY AUTOINCREMENT NOT NULL,
-	`record_type` text NOT NULL,
-	`record_key` text NOT NULL,
-	`lookup_key` text,
-	`secondary_key` text,
-	`status` text NOT NULL,
-	`schema_version` integer DEFAULT 1 NOT NULL,
-	`created_at` text NOT NULL,
-	`updated_at` text NOT NULL,
-	`expires_at` text,
-	`payload_json` text NOT NULL,
-	`meta_json` text NOT NULL
-);
-
-CREATE INDEX IF NOT EXISTS `idx_runtime_records_type_lookup_updated` ON `runtime_records` (`record_type`,`lookup_key`,`updated_at`);
-CREATE INDEX IF NOT EXISTS `idx_runtime_records_type_status_updated` ON `runtime_records` (`record_type`,`status`,`updated_at`);
-CREATE UNIQUE INDEX IF NOT EXISTS `idx_runtime_records_type_record_key` ON `runtime_records` (`record_type`,`record_key`);
 CREATE TABLE IF NOT EXISTS `subscribers` (
 	`email` text PRIMARY KEY NOT NULL,
 	`created_at` text NOT NULL